Please check the splunkd.log 08-30-2017 21:03:32.004 -0400 INFO TcpOutputProc - Connected to idx=10.100.xxx.1:9997, pset=0, reuse=0. 08-30-2017 21:03:32.008 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunkforwarder/var/log/splunk/searchhistory.log'. 08-30-2017 21:03:32.009 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunkforwarder/var/log/splunk/splunkd_access.log'. 08-30-2017 21:03:32.011 -0400 INFO WatchedFile - Will begin reading at offset=57592 for file='/opt/splunkforwarder/var/log/splunk/audit.log'. 08-30-2017 21:03:32.013 -0400 INFO WatchedFile - Will begin reading at offset=969 for file='/opt/splunkforwarder/var/log/splunk/conf.log'. 08-30-2017 21:03:32.014 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunkforwarder/var/log/splunk/mongod.log'. 08-30-2017 21:03:32.016 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunkforwarder/var/log/splunk/license_usage.log'. 08-30-2017 21:03:32.017 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunkforwarder/var/log/splunk/license_usage_summary.log'. 08-30-2017 21:03:32.019 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunkforwarder/var/log/splunk/remote_searches.log'. 08-30-2017 21:03:32.020 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunkforwarder/var/log/splunk/scheduler.log'. 08-30-2017 21:03:32.022 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunkforwarder/var/log/splunk/splunkd_ui_access.log'. 08-30-2017 21:03:32.024 -0400 INFO WatchedFile - Will begin reading at offset=369 for file='/opt/splunkforwarder/var/log/splunk/splunkd_stderr.log'. 08-30-2017 21:03:32.025 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/splunkforwarder/var/log/splunk/splunkd_stdout.log'. 08-30-2017 21:03:32.102 -0400 INFO WatchedFile - Will begin reading at offset=20365668 for file='/opt/splunkforwarder/var/log/splunk/metrics.log'. 08-30-2017 21:14:07.561 -0400 INFO WatchedFile - Will begin reading at offset=0 for file='/opt/scripts/rsda.txt'. 08-30-2017 21:29:06.640 -0400 INFO WatchedFile - Will begin reading at offset=0 for file='/opt/scripts/rsda.txt'. I need the file /opt/scripts/rsda.txt to be indexed , this is file is recreated every 15 mins.... but this is not coming to indexer both UF and Indexer are in Linux, ping is working both ways.... I have searched , there are so many posts but none is addressing this problem.. Thank you AB ... View more

SHOULD_LINEMERGE = true MAX_EVENTS = 99999 TRUNCATE = 9999999 SHOULD_LINEMERGE = false LINE_BREAKER = ((FAIL*)) I have tried both of above (trying each one at a time) in indexer props.conf ...and restarted splunk..to have a simple text file , entire file to go to single event but whatever I do splunk automatically splitting the file into 2 events Is there any way to have the entire file to single event Thank you in advance AB ... View more

I have setup a universal forwarder to an Indexer. I have done below configurations, but the forwarder instance is not showing in monitoring console, giving a messge 'search produced no result' Indexer & searchhead (same server) input.conf [splunktcp://9997] disabled = 0 connection_host = ip restarted indexer Forwarder output.conf [tcpout:rh_det] server = 10.172.96.72:9997 [tcpout-server://10.172.96.72:9997] input.conf [monitor://opt/scripts/rh.txt] disabled = false recursive = true index=rhsub _TCP_ROUTING = rh_det restarted forwarder ... View more

Hello All, I have a multiline very big string exported from excel CSV file to splunk...it worked good i can see all the values in fields now if I want to search index = xxxxxx source = yyyyyyyy field = " below given sample field value" then I am getting NO RESULT Do I need any special search methods to be used to match exact string ????? sample field value is below (PLease note this forum is not showing 100% match of my text when I paste here, but it is 90% match ) The ! (exclamation point) before SSLv2 is what disables this protocol. Windows Disable SSLv2 protocol support in Microsoft Windows Configure the server to require clients to use at least SSLv3 or TLS. For Microsoft Windows before Windows 2003, see KB187498 (http://support.microsoft.com/kb/187498) . For newer versions of Microsoft Windows, see KB245030 (http://support.microsoft.com/kb/245030) . Disable insecure TLS/SSL protocol support Configure the server to require clients to use TLS version 1.2 using Authenticated Encryption with Associated Data (AEAD) capable ciphers. ... View more

I have to show results like below in a dashboard. For example: 1) first table shows all the sales orders, as of now system has two sales order 2) then I need to show below the sales order table, something like: Details of sales order 1001 ..... ..... .... Details of Sales order 1002 ..... ..... .... Can someone please explain how can I show this? Thank you In advance ... View more

I have 5 different searches (each search itself contains commands join , multisearch etc...), From each search, I get 3 to 4 fields, I have to show these fields in a single row of a table in multiple columns (so table the contains columns 15-20) Could you please help if this is possible? Thank you AB ... View more